Edit account user

Overview

Update an existing account user — their name/title, role, store assignments, optional password, and deactivation date. You cannot edit your own user record. A password change revokes that user's live tokens and is audited. The user must belong to the caller's account company.

Prerequisites

• A bearer token in the Authorization header.

Base URL

Endpoint

POST /api/v1/user/edit

Authentication

• Requires a bearer token in the Authorization: Bearer <bearer-token> header.

• Account admin — send an account bearer token.

• Authorization checks three things:

  • Your company must be an account (bundle_id = BRAND).
  • The target user must be in that same company.
  • The target must not be yourself — editing your own record returns 403.

Rate limit

• No rate limit.

Request body

{
  "user": 12,
  "first_name": "Jane",
  "last_name": "Smith",
  "title": "Manager",
  "password": null,
  "user_type": "location_assign",
  "store_ids": [
    12
  ],
  "assign_all_accounts": 1,
  "send_default_reports": 1,
  "inactive_at": null
}

How it works

• Synchronous (DB transaction). 200 on success.
• 403 when authorize fails (not an account / target not in company / editing self).
• 422 on validation failure; 500 on save failure (rolled back).

Response

200 OK · 200

{
  "data": {
    "status": "success",
    "response": "User information has been updated successfully"
  }
}

403 Unauthorized · 403

{
  "message": "This action is unauthorized."
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/api/v1/user/edit" \
  --header 'Authorization: Bearer <bearer-token>' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"user": 12, "first_name": "Jane", "last_name": "Smith", "title": "Manager", "password": null, "user_type": "location_assign", "store_ids": [12], "assign_all_accounts": 1, "send_default_reports": 1, "inactive_at": null}'